If a user that does not have permission to print an entity, but have access to the content overview page "admin/content" they can still see the download pdf. When they click on it an error is thrown saying: "You must pass at least entity".
to reproduce:
- enable entity_print
- make sure a user does not have permission "Access Printable version of View"
- go to admin/content page
- select a piece of content
- click on download as PDF.

Expected result : " deny access"
Actual result: exception: "You must pass at least entity".

Possible cause
When access is denied $enteties are being passed as an empty array to renderer.

Proposed Solution
Check $entities array is not empty before sending the array to the renderer, patch attached.
| Comment | File | Size | Author |
|---|---|---|---|
| #27 | access-denied.png | 142.54 KB | jannakha |
| #23 | entity_print-2969357-21.patch | 1.39 KB | awm |
| #20 | entity_print-2969357-9.patch | 1.46 KB | awm |
| Screen Shot 2018-05-03 at 4.00.48 PM.png | 71.28 KB | awm | |
| Screen Shot 2018-05-03 at 3.55.46 PM.png | 43.35 KB | awm |
Comments
Comment #2
awm commentedComment #3
awm commentedComment #4
awm commentedComment #7
awm commentedComment #8
awm commentedComment #9
awm commentedComment #10
awm commentedComment #11
awm commentedComment #12
benjy commentedNormally we'd wrap access control around the button/action displayed in the UI. Is it possible to add the access control to the VBO action?
Comment #13
awm commentedThis not using VBO. Just core views. With VBO module there is a submodule that does action permissions but that's something else. It perhaps possible to hide the button but I'm not sure where.
Hiding the button is also not enough as you could still access the route somehow and the exception get thrown where it should be access denied.
Comment #14
benjy commentedIf you access the route directly then the access check should be done at the route level. Sorry I meant core views actions, I thought they supported access control also but i've not checked.
Comment #15
awm commentedI doubt they support that that's why they have action_permissions. It's similar to any other action such as edit, delete ..etc. they all are displayed despite lacking the permissions for the operations. If an action is performed by a user with no permission, for example, delete, a denial message is displayed without an error. I think entity_print should do the same.
Comment #16
benjy commentedI thought that behaviour was controlled by AccessInterface::access() but i'd have to look closer to say for sure.
The thing I don't like about the current approach is we are catching all \InvalidArgumentExceptions, which opens up to suppressing other potential failures.
Comment #17
awm commentedSo entity_print implements access correctly and the user gets the message "No access to execute..." after the exception is thrown when the user refresh the page "admin/content". But for some reason the exception is thrown (either before or after), prevent normal flow. I will change the patch to not catch the exception.
Comment #18
awm commentedComment #20
awm commentedHere is what I found is going on between entity_print and views: (code commented)
So unless views is doing something wrong, we need to check if entities are empties; which means access was denied.
updated the patch.
Comment #21
awm commentedComment #22
awm commentedalthough( entity_print-2969357-9.patch) patch passed my basic testing on my local environment , but on a live env with https, nginx, load balancer, it's causing blank screen. I am assuming because the returned response is malformed. Not sure what's the most appropriate response.
Comment #23
awm commentedAnother attempt since it seems the that
Fails when deliverPrintable returns false on an environment with https, nginx and loadbalancer. here is some pics of the response header/preview:
1. https://i.imgur.com/CFNoLOb.png
2. https://i.imgur.com/fdeOzpi.png
Comment #24
benjy commentedIs there anything in the nginx or balancer logs?
Comment #25
awm commentedNothing that stood out as far as I looked but will dig more when i have time. But I am almost certain it has to do with StreamedResponse .
Perhaps streamedResponse should not be instantiated if there are no entities?
Comment #26
avpadernoI am deleting a file as requested.
Comment #27
jannakha commentedthis looks like an outdated issue, tested on D11.2 Entity Print Version: 8.x-2.16

Comment #28
avpaderno